diff --git a/nuclei-templates/cve-less/plugins/zephyr-project-manager-ae04686326d43f919e9c393e1e364c95.yaml b/nuclei-templates/cve-less/plugins/zephyr-project-manager-ae04686326d43f919e9c393e1e364c95.yaml new file mode 100644 index 0000000000..9a6bd53c06 --- /dev/null +++ b/nuclei-templates/cve-less/plugins/zephyr-project-manager-ae04686326d43f919e9c393e1e364c95.yaml @@ -0,0 +1,59 @@ +id: zephyr-project-manager-ae04686326d43f919e9c393e1e364c95 + +info: + name: > + Zephyr Project Manager <= 3.3.102 - Missing Authorization to Authenticated (Subscriber+) Status Updates + author: topscoder + severity: low + description: > + + reference: + - https://github.com/topscoder/nuclei-wordfence-cve + - https://www.wordfence.com/threat-intel/vulnerabilities/id/6746d20c-d528-4c69-95e4-9f22d6460463?source=api-scan + classification: + cvss-metrics: + cvss-score: + cve-id: + metadata: + fofa-query: "wp-content/plugins/zephyr-project-manager/" + google-query: inurl:"/wp-content/plugins/zephyr-project-manager/" + shodan-query: 'vuln:' + tags: cve,wordpress,wp-plugin,zephyr-project-manager,low + +http: + - method: GET + redirects: true + max-redirects: 3 + path: + - "{{BaseURL}}/wp-content/plugins/zephyr-project-manager/readme.txt" + + extractors: + - type: regex + name: version + part: body + group: 1 + internal: true + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + - type: regex + name: version + part: body + group: 1 + regex: + - "(?mi)Stable tag: ([0-9.]+)" + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - "zephyr-project-manager" + part: body + + - type: dsl + dsl: + - compare_versions(version, '<= 3.3.102') \ No newline at end of file